Executive brief
DeepChat is an open-source platform used to manage and interact with various artificial intelligence models and tools. A security flaw allows a malicious AI response or a compromised server to send specially crafted links that, when clicked by a user, can execute unauthorized commands on the user's computer. This could lead to a complete takeover of the host system, theft of sensitive files, or the installation of malware.
Technical details
DeepChat is vulnerable to an arbitrary protocol execution bypass leading to Remote Code Execution (RCE). While a previous fix (CVE-2025-55733) restricted the 'api.openExternal()' function in the renderer's preload script, it failed to secure the 'setWindowOpenHandler' in 'src/main/presenter/tabPresenter.ts'. When a Markdown link with 'target="_blank"' is clicked, Electron's native window handler intercepts the request and passes the URL directly to 'shell.openExternal(url)' without validating it against the 'isValidExternalUrl' whitelist. An attacker can exploit this by providing a malicious URL (e.g., using 'smb://' or 'ms-msdt://' protocols) via a compromised AI backend or prompt injection, resulting in a sandbox escape. The issue is resolved in version v1.0.4-beta.1.
Affected products
- ThinkInAIXYZ DeepChat < v1.0.4-beta.1
Timeline
- 2026-04-25: advisory: GitHub Security Advisory published by developer
- 2026-05-11: disclosed: CVE-2026-43899 published to NVD
- 2026-05-11: patched: Fixed in version v1.0.4-beta.1